Ampache allows users who can upload audio files to embed JavaScript in the ID3 lyric tag of a song. When the song is viewed through the lyrics view component, the unescaped tag content is placed in the page, allowing an attacker to run code in the browser of any user who accesses the lyric text. The vulnerability is a classic stored cross‑site scripting flaw that can lead to session hijacking, credential theft, or further network exploitation within the victim’s browser context.

The flaw exists in all Ampache releases prior to version 8.4.0. Users running Ampache 8.3.9 or earlier that permit file uploads are vulnerable. No specific operating systems or database versions are tied to the issue; the weakness lies in the web application's handling of ID3 lyrics.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score is not available, suggesting limited data on exploitation frequency. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it only when a user with upload rights submits a malicious file; the path to exploitation is straightforward and does not require additional prerequisites.